file[.]exe | Triage™

General

Target
file.exe
Size 228KB
Sample221227-bec3eaea88
SHA256 85d5c21f99e904e4be82cbe5ae6503a45fef2fe74f5de94fc673854ec3a20116
MD5 ee257979dd26f5f5a61842fc470cf710
SHA1 f56a6d65c24f06880657c1b3ac889ca5e122405d
SHA512 1f46049b2af8cac1ca8bcc0619a16366acc0d494662fc55228314e464cc16f3dba3dd5e6479322122c07cd0307250da88cdd5ce07c9b68f5ae576b1cabfab7e2
SSDEEP 3072:Oq29LJ8+5Ifla92bD/GLiuWGPWVXO5r/2jLptKisew+V+Y700:aLJ8/NxuWWsX6/qHjsew+Vl7l
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 228KB

file.exe

IMPHASH 770342bbcc7220bf3afa71cf90800857
SHA256 85d5c21f99e904e4be82cbe5ae6503a45fef2fe74f5de94fc673854ec3a20116
MD5 ee257979dd26f5f5a61842fc470cf710
SHA1 f56a6d65c24f06880657c1b3ac889ca5e122405d
SHA512 1f46049b2af8cac1ca8bcc0619a16366acc0d494662fc55228314e464cc16f3dba3dd5e6479322122c07cd0307250da88cdd5ce07c9b68f5ae576b1cabfab7e2
SSDEEP 3072:Oq29LJ8+5Ifla92bD/GLiuWGPWVXO5r/2jLptKisew+V+Y700:aLJ8/NxuWWsX6/qHjsew+Vl7l
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

14532

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateDirectoryExW GetLogicalDriveStringsW ReadConsoleInputW CallNamedPipeW GetSystemDirectoryA CreateMailslotW TlsSetValue GetProcAddress LocalAlloc MoveFileWithProgressW GetBinaryTypeA SearchPathA GetCommandLineA InterlockedIncrement VerifyVersionInfoW ConvertDefaultLocale FindFirstVolumeW LocalFree GlobalFlags ExitProcess CreateActCtxA GlobalFindAtomW GetConsoleAliasA VerSetConditionMask CreateMutexW DeactivateActCtx GetDiskFreeSpaceA MoveFileA SetEvent MoveFileExW OpenMutexA FindResourceW SetFileTime lstrcatA SetFilePointer FindFirstFileA FreeEnvironmentStringsA EnumResourceLanguagesA InterlockedCompareExchange SetConsoleMode InterlockedExchangeAdd AreFileApisANSI GetModuleHandleW GetTickCount CopyFileW LoadLibraryA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree CloseHandle EnterCriticalSection LeaveCriticalSection HeapAlloc Sleep WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateFileA

user32

CharUpperBuffA

advapi32

InitiateSystemShutdownA

Sharing